GDPR Compliance

1. Our GDPR Commitment

As both a data controller (for data we collect directly) and a data processor (for data our customers store on our platform), we are committed to:

• Processing personal data lawfully, fairly, and transparently
• Collecting data only for specified, explicit, and legitimate purposes
• Minimizing data collection to what is necessary for the stated purpose
• Ensuring data accuracy and keeping it up to date
• Retaining data only as long as necessary
• Implementing appropriate technical and organizational security measures
• Maintaining records of our processing activities

2. Legal Basis for Processing

We process personal data under the following legal bases as defined in Article 6 of the GDPR:

3. Your Rights Under GDPR

If you are in the EEA, UK, or Switzerland, you have the following rights in relation to your personal data:

We will respond to rights requests within 30 days. In complex cases or where there are many requests, this may be extended by an additional 60 days with prior notification.

4. Data Controller & Processor Roles

SUBLAKE acts in two capacities depending on the context:

• As Data Controller: For personal data we collect directly from you (account information, usage data, marketing interactions). We determine the purposes and means of processing.
• As Data Processor: For personal data that you (our customer) store on our platform (your contacts, customer communications, and business records). You determine the purposes; we process on your instructions.

When we act as a data processor, you remain the data controller and are responsible for ensuring you have a lawful basis for processing the personal data of your own customers.

5. Data Processing Agreement

We offer a Data Processing Agreement (DPA) to all customers as required by Article 28 of the GDPR. Our DPA covers:

• Subject matter and duration of processing
• Nature and purpose of processing
• Types of personal data processed
• Categories of data subjects
• Obligations and rights of the controller
• Standard Contractual Clauses (SCCs) for international transfers
• The technical and organizational security measures we apply
• The list of sub-processors we engage

6. Sub-Processors

We engage the following sub-processors to help provide our Services. Each is engaged under a written agreement containing data-protection terms. Sub-processors marked "only when you connect it" receive data only if you choose to connect that channel or integration.

The authoritative, current sub-processor list is maintained at /subprocessors. We will notify customers of any new sub-processor at least 30 days before it begins processing data. Customers may object to a new sub-processor as outlined in our DPA.

7. International Data Transfers

As our infrastructure is primarily located in the United States, personal data from EEA, UK, and Swiss residents may be transferred internationally. Where such data is transferred to a country not deemed adequate, we rely on:

• Standard Contractual Clauses (SCCs): the European Commission's 2021 SCCs (Module Two: Controller-to-Processor) with our sub-processors
• UK Addendum: the UK International Data Transfer Addendum to the SCCs for UK transfers
• Swiss addendum: the Swiss FADP equivalent terms for transfers from Switzerland
• Supplementary measures: additional technical safeguards such as encryption where appropriate

8. Technical & Organizational Measures

We implement technical and organizational security measures appropriate to the risk, consistent with Article 32 of the GDPR:

Technical Measures

• Encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256)
• Tenant isolation so each customer's data is logically separated from others
• Least-privilege access controls for the systems that hold personal data
• Automated backups to support recovery

Organizational Measures

• Confidentiality obligations for personnel with access to personal data
• Use of reputable sub-processors engaged under data-protection terms
• A documented incident-response process, including 72-hour breach notification

9. Data Breach Notification

In the event of a personal data breach, we will:

• Notify affected customers (data controllers) without undue delay and within 72 hours of becoming aware of the breach
• Provide detailed information about the nature of the breach, categories of data affected, and remedial measures taken
• Cooperate with customers in their obligations to notify supervisory authorities and affected individuals
• Document all breaches, including those that do not meet the notification threshold, as part of our internal records

10. Privacy Contact

For any GDPR-related inquiries, data subject requests, or to report a data protection concern, please contact us:

11. How to Exercise Your Rights

To exercise any of your rights under the GDPR:

1. Email us at contact@sublake.com with the subject "GDPR Rights Request"
2. Include your full name, email address associated with your account, and the specific right you wish to exercise
3. Verification: We may ask you to verify your identity before processing your request
4. Timeline: We will acknowledge receipt promptly and fulfill your request within 30 days (extendable by up to 60 days for complex requests, with notice)

There is no fee for exercising your rights. However, we may charge a reasonable fee for manifestly unfounded or excessive requests, or refuse to act on such requests.

12. Right to Lodge a Complaint

If you believe that our processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority. You can file a complaint with:

• The supervisory authority in your country of residence
• The supervisory authority in the country where you work
• The supervisory authority in the country where the alleged infringement occurred

We encourage you to contact us first so we can attempt to resolve any concerns directly. We take all privacy complaints seriously and will respond promptly.